CISA release October 27, 2026; Help Net Security report October 28, 2026
CISA Ships ScubaGear 2.0 and ScubaGoggles 1.1.0 for Microsoft 365 and Google Workspace Baselines
CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of its free open-source tools that check Microsoft 365 and Google Workspace tenants against the agency's Secure Cloud Business Applications (SCuBA) baselines and report the settings that miss them. CISA calls ScubaGear v2.0 the most comprehensive update since the tool's 2022 launch: it now makes direct REST API calls for every supported Microsoft 365 product, which CISA says makes assessments faster and more accurate, completing a shift that began with Entra ID in version 1.6.0 and SharePoint and Power Platform in 1.8.0. ScubaGear compares tenant settings against policies written in Rego and reports in HTML, JSON, and CSV across Entra ID, Defender for Office 365, Exchange Online, OneDrive for Business, Power BI, Power Platform, SharePoint Online, and Teams; CISA reported more than 30,000 downloads in 2024. ScubaGoggles v1.1.0, for Google Workspace, adds an assured controls baseline, a smaller high-confidence control set CISA describes as tailored for resource-strapped teams, plus enhanced controls for Gemini, Google's AI assistant. Its baselines cover Gmail, Calendar, Chat, Classroom, Drive and Docs, Meet, Sites, and Groups for Business, plus common controls. The tools are built for federal civilian agencies and are available to any organization.
Executives
Cloud misconfiguration is the quiet exposure behind louder incidents, including the token replay campaign in this edition, where Conditional Access gaps decided which organizations were breached. CISA's updated tools are free and produce a findings list a leadership team can actually review. The decision is only whether someone owns running them on a schedule and closing what they find.
CIO / CISO
Run ScubaGear v2.0 and ScubaGoggles v1.1.0 against your tenants and diff the results against your last baseline run, so improvements and regressions are both visible. Prioritize identity and email findings first, and give the new Gemini controls an owner, because AI assistant settings in Google Workspace now sit inside the same baseline discipline as the rest of the tenant, consistent with the Govern function of the NIST AI RMF.
Engineers
Upgrade your SCuBA tooling rather than re-running an old version: the direct API change in ScubaGear v2.0 changes both speed and coverage, so old results are not comparable line for line. Keep the HTML, JSON, and CSV outputs as dated evidence with your change records, and document accepted exceptions in the report trail instead of letting them live in chat threads.
Everyone (non-IT)
If your workplace uses Microsoft 365 or Google Workspace, the settings that decide who can share files, sign in, and use the built-in AI assistant are checked against a public baseline. Nothing here asks you to change anything yourself; it is why your IT team may announce setting changes in the coming weeks.